Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 21:43

General

  • Target

    c927270cfeaba76dd08545d20b8c48b126c69f162409faae795acc19db4d4132.xls

  • Size

    96KB

  • MD5

    29e2bccd87a170c554356907f08061be

  • SHA1

    4d7f58d4c2edba78ce71eb6cf487cf9b9b6193ff

  • SHA256

    c927270cfeaba76dd08545d20b8c48b126c69f162409faae795acc19db4d4132

  • SHA512

    9d4976ada1881790fb90d2e2e72ccb261c634797d77217bdb8e65aacf3b80fcc6a6fcdec21b3c45ffa047935a99411ba0184e523a3afc4a3208b5642bdf44bd4

  • SSDEEP

    1536:7kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2HuS4hcTO97v7UYdEJmw:IKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/EOgFGo17w/

xlm40.dropper

https://eliteturismo.com/phpmailer-old/dafdBxQONtk5Uf9dxll/

xlm40.dropper

http://atici.net/c/JDFDBMIz/

xlm40.dropper

http://domesticuif.co.za/libraries/nbnH9dpd/

Signatures

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c927270cfeaba76dd08545d20b8c48b126c69f162409faae795acc19db4d4132.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
      2⤵
      • Process spawned unexpected child process
      PID:828
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
      2⤵
      • Process spawned unexpected child process
      PID:684
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci3.ocx
      2⤵
      • Process spawned unexpected child process
      PID:4520
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci4.ocx
      2⤵
      • Process spawned unexpected child process
      PID:1696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    2KB

    MD5

    94b018e29d149d97a4cf098ddf2be68e

    SHA1

    21b3ae20cdc0ad498dab2ec650621c5709522951

    SHA256

    c753cbeb785f00e0a55914bae80f6105c896250b3480955940112d0955019738

    SHA512

    64fab49cce60401cf481e29e4d3b1c60c5e90620b873e2e2d89401aa810f2085366306e65ca656f5350063e288555a006a85b7d903e4835ed6f6e926a2e39973

  • memory/588-7-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

    Filesize

    64KB

  • memory/588-11-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-2-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

    Filesize

    64KB

  • memory/588-4-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

    Filesize

    64KB

  • memory/588-5-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-6-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-0-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

    Filesize

    64KB

  • memory/588-8-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-12-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-1-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

    Filesize

    64KB

  • memory/588-10-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-9-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-13-0x00007FF8848D0000-0x00007FF8848E0000-memory.dmp

    Filesize

    64KB

  • memory/588-14-0x00007FF8848D0000-0x00007FF8848E0000-memory.dmp

    Filesize

    64KB

  • memory/588-40-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

    Filesize

    2.0MB

  • memory/588-3-0x00007FF8C69ED000-0x00007FF8C69EE000-memory.dmp

    Filesize

    4KB